wireguard dynamic WAN IP

[yhq_34]

Hi,

Is there any way to keep updating WAN IP if the ip was changed? I have found my site to site VPN was disconnected when one side WAN IP was changed.

[chemlud]

You can have the client on the side with changing IPs. Otherwise a script could check your tunnel and restart WG if necessary...

[yhq_34]

OK, is there a setting exist in the opnsense to complete this action?

[jp0469]

I have a peer to peer Wireguard VPN set up and both networks use dynamic DNS to point to their respective public IPs. When I set up the endpoints, I used their hostnames instead of IP addresses and it seemed to work. I don't know how often they are checked and neither IP has changed since I set up the tunnel but I'm hoping it will work seamlessly.

[shuvitcrew]

Wireguard will work with host names as well, but will hang after a reboot of the system. You have to start the service after a reboot manually.

[jp0469]

Wireguard will work with host names as well, but will hang after a reboot of the system. You have to start the service after a reboot manually.

Any idea how often the hostnames are resolved or is it a continuous thing?

[chemlud]

ONCE, when the tunnel is started. Never afterwards, even if the DynDNS get's updated and therefore the tunnel fails...

[Layer8]

I am running wg site 2 site with opnsense at links with dynamic IPs. So the IPs change mininimum every month while updating opnsense.

ONCE, when the tunnel is started. Never afterwards, even if the DynDNS get's updated and therefore the tunnel fails...

Is this still the case?

Is there a workaround/script/something like that to solve this problem?

[zerwes]

I can confirm: DNS resolution is only done once at the initialization of the connection.
On client side you can run something like this as bash script via cron as root:
WGNAME=wg0; SRVDNS=$(sed '/^Endpoint */!d;s/^.*= *//g;s/:.*$//g' /etc/wireguard/$WGNAME.conf); CONIP=$(wg show $WGNAME | sed '/endpoint:/!d;s/ *endpoint: //g;s/:.*$//g'); DNSIP=$(dig +noall +answer $SRVDNS | sed '/\tA\t/!d;s/^.*\tA\t//g'); if [ "$CONIP" != "$DNSIP" ]; then ifdown $WGNAME: sleep 1; ifup $WGNAME; fi

[Layer8]

Thank you. Will test this script.

I also opened a feature request here: https://github.com/opnsense/plugins/issues/2927

If you are interested in this, please support it on github.

[zerwes]

IMHO this is a classical job for monit, nothing that needs to be fixed upstream.

[ferazop]

You will probably have to change the IP addresses in your client profiles, yes. To solve this automatically, get a cheap domain and setup dynamic dns with that, or use a free dynamic dns service. And then setup Wireguard to work with your new domain or dyndns name.
techzpod download mobdro

[Vilhonator]

You will probably have to change the IP addresses in your client profiles, yes. To solve this automatically, get a cheap domain and setup dynamic dns with that, or use a free dynamic dns service. And then setup Wireguard to work with your new domain or dyndns name.

That is pretty much easiest option.

To make wireguard (or any service which is dependent on public IP), you need to have either static IP or own domain which DNS A record can be updated using dynamic DNS service.

For VPN more complicated way would be using IPv6 address (those don't change if I'm not mistaken), but setting that to work, is less painfull than sticking a fork in your eye.

[chemlud]

Unfortunately this issue has never been resolved for opnsense, while in the GUI of pfsense you can choose a time interval for "Endpoint Hostname Resolve Interval" under VPN -> WG -> Settings.

I don't want to mess around with script/cron stuff for basic tunnel functionality. Any solution in sight?

[Greelan]

I assume you are aware that the WG script for this (same as what pfSense uses) has been added to OPNsense: https://github.com/opnsense/plugins/pull/2956

The only thing missing is a convenient button in the UI to configure the running interval for the script. But not that much more work to set up the cron job